Filtering URLS for output PHP

Question

I'd like to make sure URLs such as javascript:alert('a'); and vbscript varients etc. are not allowed by whitelisting https?|ftp That's easy enough: ^(?:https?|ftp):// But how can I allow relative urls as well? such as ../../../blah and ./blah also /images/img.png

In other words is using ^(?:(?:https?|ftp)://|[./]) safe?

I've asked around and a possible solution might be: parse_url

if !scheme or scheme == http or scheme == https or scheme == ftp or scheme == mailto

What exactly are you trying to do, what are you trying to protect against? — Pekka
– Pekka, Commented May 2, 2011 at 10:23
XSS, I'm trying to filter URLs such to go into <a href="" or <img src="" — John
– John, Commented May 2, 2011 at 10:26

Gumbo · Accepted Answer · 2011-05-02 10:41:09Z

1

Instead of using regular expressions you could use parse_url and check that scheme is either empty or one of http, https, and ftp:

$components = parse_url($url);
if (!isset($url['scheme']) || in_array(strtolower($url['scheme']), array('http', 'https', 'ftp'))) {
    // valid
} else {
    // invalid
}

answered May 2, 2011 at 10:41

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

John Over a year ago

Yep I added that to my question 5 mins ago. :)

Gumbo Over a year ago

@John: I hadn’t noticed that. :)

Community · Accepted Answer · 2023-11-20 22:45:59Z

1

Also see: Sanitizing strings to make them URL and filename safe?

I'm trying to filter URLs such to go into <a href="" or <img src=""

Be careful, because it's possible to "break out" of the attribute with just a "starts with" regular expression. For instance, I could provide http://safeurl.com" onclick="alert('xss attack'), and when inserted into your attribute you would have:

<a href="http://safeurl.com" onclick="alert('xss attack')">

Make sure to urlencode() the value as well as any other security you're doing.

I would probably consider against allowing ../../relative/urls or perhaps using parse_url as Gumbo has suggested.

Check out the info on OWASP.org for some more advice.

edited Nov 20, 2023 at 22:45

CommunityBot

11 silver badge

answered May 2, 2011 at 10:51

No Results Found

103k38 gold badges199 silver badges232 bronze badges

2 Comments

John Over a year ago

Thanks, I was going to use hrtmlentities to properly escape the data before putting it in the attributes. I'm not sure urlencode() should be used?

No Results Found Over a year ago

I would use urlencode() on each slashed segment to be safe. This is definitely worth writing a function for, something really solid and paranoid.

Collectives™ on Stack Overflow

Filtering URLS for output PHP

2 Answers 2

2 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related